Google now supports RFC 9449 DPoP binding for OAuth refresh tokens, replacing traditional bearer tokens with application-layer cryptographic keypairs. The design targets infostealer malware and adversary-in-the-middle attacks by binding long-lived credentials to a client-generated asymmetric key. High-throughput access tokens remain standard bearer tokens to avoid per-request cryptographic overhead at the API gateway layer.
It is worth implementing if you are hardening server-to-server integrations or agent architectures against credential theft, but skip it if your stack cannot easily manage client-side key storage and strict nonce handling. The scheme also does nothing to protect standard browser session cookies, requiring you to wait for separate Device Bound Session Credentials proposals for full coverage.
more: https://developers.googleblog.com/announcing-dpop-support-for-google-oauth-securing-refresh-tokens/
Leave a Reply